@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.5 → 0.4.8

package/src/context/ChatBotContext.tsx

@@ -23,6 +23,7 @@ import type {
   Attachment,
   ClientTtsVoiceSettings,
   Message,
+  RuntimeAITResult,
   ServicePermission,
 } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 import {
@@ -36,11 +37,26 @@ import {
   ChatBotProps,
   PresetMessage
 } from '../types/ChatBotTypes';
-import { waitForAITPermissions } from '../aitPermissionPropagation';
 import { AuthorizationLoadingState } from '../authorizationLoadingState';
 import { PendingTextToolRetryController } from '../pendingTextToolRetry';
 import { completePiiScan } from '../piiMessageState';
 import { filterSuggestions } from '../suggestionState';
+import {
+  dispatchRuntimeAITCompleteReplacement,
+  removeOneDeniedPermission,
+  replaceCurrentMaximumDenyList,
+  RuntimeAITMutationQueue,
+  RuntimeAITRecomputeCoordinator,
+  StaleRuntimeAITResponseError,
+  runtimeAITContextKey,
+  runtimeAITSubjectKey,
+  runtimeAuthorizationMatchesContext,
+  runtimeAuthorizationState,
+  unavailableRuntimeAuthorization,
+  useProviderRuntimeCommit,
+  useRuntimeAITContextCommit,
+  type RuntimeAITContext,
+} from '../permissionState';
 
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 
@@ -71,6 +87,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   environment = 'production',
   onVerifyWallet,
   permissionGroup,
+  roles,
   children,
   // AI Model related attributes
   onModelChange,
@@ -93,9 +110,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   debugVoiceRms = false,
   sttGlossary,
 }) => {
-  // Set API hosts immediately based on environment (before any API calls)
-  setApiHosts(environment);
-
   const nxtlinqApi = React.useMemo(
     () => (serviceToken || getAuthToken
       ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
@@ -155,7 +169,22 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [hitAddress, setHitAddress] = React.useState<string | null>(null);
   const [ait, setAit] = React.useState<AIT | null>(null);
   const [permissions, setPermissions] = React.useState<string[]>([]);
-  const [availablePermissions, setAvailablePermissions] = React.useState<ServicePermission[]>([]);
+  const [maximumPermissions, setMaximumPermissions] = React.useState<string[]>([]);
+  const [deniedPermissions, setDeniedPermissions] = React.useState<string[]>([]);
+  const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+  const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] =
+    React.useState<string | null>(null);
+  const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState<ServicePermission[]>([]);
+  const availablePermissions = React.useMemo(
+    () => maximumPermissions.map((label) =>
+      servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+      }),
+    [maximumPermissions, servicePermissionCatalog],
+  );
   const [showPermissionForm, setShowPermissionForm] = React.useState(false);
   const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
   const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -164,6 +193,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [walletInfo, setWalletInfo] = React.useState<any>(null);
   const [isWalletLoading, setIsWalletLoading] = React.useState(false);
   const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+  const runtimeRolesKey = JSON.stringify(roles ?? null);
 
   // Persistent data (always use localStorage)
   const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage<string>('nxtlinqAITServiceAccessToken', '');
@@ -220,6 +250,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const hitAddressRef = React.useRef(hitAddress);
   const aitRef = React.useRef(ait);
   const permissionsRef = React.useRef(permissions);
+  const deniedPermissionsRef = React.useRef(deniedPermissions);
   const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
   const signerRef = React.useRef(signer);
   const authorizationLoadingStateRef = React.useRef(
@@ -241,6 +272,14 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       );
     });
   }, []);
+  const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+  const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+  useProviderRuntimeCommit(
+    hitAddressRef,
+    hitAddress,
+    environment,
+    setApiHosts,
+  );
 
   // Helper function to combine customUsername with Adilas customUserInfo
   const getFinalCustomUsername = React.useCallback((username: string | undefined): string | undefined => {
@@ -574,10 +613,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   }, []);
 
   // Update refs when state changes
-  React.useEffect(() => {
-    hitAddressRef.current = hitAddress;
-  }, [hitAddress]);
-
   React.useEffect(() => {
     aitRef.current = ait;
   }, [ait]);
@@ -594,6 +629,10 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     authorizationLoadingStateRef.current.setAutoConnecting(isAutoConnecting);
   }, [isAutoConnecting]);
 
+  React.useEffect(() => {
+    deniedPermissionsRef.current = deniedPermissions;
+  }, [deniedPermissions]);
+
   React.useEffect(() => {
     nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
   }, [nxtlinqAITServiceAccessToken]);
@@ -1024,7 +1063,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         console.error('Failed to fetch permissions:', result.error);
         return undefined;
       }
-      setAvailablePermissions(result.permissions);
+      setServicePermissionCatalog(result.permissions);
       return result.permissions;
     } catch (error) {
       console.error('Error fetching permissions:', error);
@@ -1032,7 +1071,109 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  // Refresh AIT
+  const clearRuntimeAuthorization = React.useCallback(() => {
+    const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    setAit(cleared.ait);
+    setPermissions(cleared.effectivePermissions);
+    setMaximumPermissions(cleared.maximumPermissions);
+    setRuntimePermissionsUnavailable(cleared.unavailable);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+
+  const applyRuntimeResult = React.useCallback((result: RuntimeAITResult, context: RuntimeAITContext) => {
+    const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+    aitRef.current = next.ait;
+    permissionsRef.current = next.effectivePermissions;
+    setAit(next.ait);
+    setPermissions(next.effectivePermissions);
+    setMaximumPermissions(next.maximumPermissions);
+    setDeniedPermissions(next.deniedPermissions);
+    deniedPermissionsRef.current = next.deniedPermissions;
+    setRuntimePermissionsUnavailable(false);
+    setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+    return result;
+  }, []);
+
+  const runtimeContext = React.useMemo<RuntimeAITContext | null>(() => hitAddress ? {
+    controller: hitAddress,
+    serviceId,
+    ...(roles !== undefined ? { roles: [...roles] } : {}),
+    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+  } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+  const invalidateCommittedRuntimeContext = React.useCallback(() => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    deniedPermissionsRef.current = [];
+    setAit(null);
+    setPermissions([]);
+    setMaximumPermissions([]);
+    setDeniedPermissions([]);
+    setRuntimePermissionsUnavailable(activeContext !== null);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+  useRuntimeAITContextCommit(
+    runtimeRecomputeCoordinatorRef.current,
+    runtimeContext,
+    invalidateCommittedRuntimeContext,
+  );
+
+  const recomputeRuntimeAIT = React.useCallback(async (context: RuntimeAITContext) => {
+    const capturedContext: RuntimeAITContext = {
+      controller: context.controller,
+      serviceId: context.serviceId,
+      ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+      ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+    };
+    return runtimeRecomputeCoordinatorRef.current.run(
+      capturedContext,
+      () => nxtlinqApi.ait.recomputeAIT(capturedContext),
+      applyRuntimeResult,
+      clearRuntimeAuthorization,
+    );
+  }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+
+  const queueRuntimeAITRefresh = React.useCallback(
+    (context: RuntimeAITContext) => runtimeMutationQueueRef.current.run(
+      runtimeAITSubjectKey(context),
+      async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+      },
+    ),
+    [recomputeRuntimeAIT],
+  );
+
+  const convergeRuntimeAITSubject = React.useCallback(async (subjectKey: string) => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+      return;
+    }
+    await recomputeRuntimeAIT(activeContext);
+  }, [recomputeRuntimeAIT]);
+
+  const dispatchRuntimeDenyListReplacement = React.useCallback(async (
+    context: RuntimeAITContext,
+    nextDeniedPermissions: string[],
+  ) => dispatchRuntimeAITCompleteReplacement(
+    runtimeRecomputeCoordinatorRef.current,
+    context,
+    () => nxtlinqApi.ait.updatePermissionDenyList({
+      ...context,
+      deniedPermissions: nextDeniedPermissions,
+    }),
+    convergeRuntimeAITSubject,
+    clearRuntimeAuthorization,
+  ), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+
+  // Refresh the authoritative runtime AIT state.
   const refreshAIT = async (forceUpdatePermissions = false) => {
     const currentHitAddress = hitAddressRef.current || hitAddress;
     const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
@@ -1041,8 +1182,10 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       permissionsRef.current = [];
       setAit(null);
       setPermissions([]);
+      setMaximumPermissions([]);
       setWalletInfo(null);
       authorizationLoadingStateRef.current.setAITLoading(false);
+      setRuntimePermissionsUnavailable(false);
       setIsAITLoading(false);
       return;
     }
@@ -1074,53 +1217,23 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         }
       }
 
-      // AIT existence is not identity verification. In strict mode, stop before
-      // the legacy AIT lookup can synthesize a custom wallet record.
       if (currentToken && !walletAllowsAITLookup) {
-        aitRef.current = null;
-        permissionsRef.current = [];
-        setAit(null);
-        setPermissions([]);
+        clearRuntimeAuthorization();
         return;
       }
 
-      // Only try to fetch AIT if we have a token
+      // Recompute is the sole mint/reuse path and the only permission authority.
       if (currentToken) {
-        const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-          serviceId,
-          controller: currentHitAddress,
-          customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-        }, currentToken);
-
-        if ('error' in response) {
-          console.error('Failed to fetch AIT:', response.error);
-          aitRef.current = null;
-          permissionsRef.current = [];
-          setAit(null);
-          setPermissions([]);
-          return;
-        }
-
-        aitRef.current = response;
-        setAit(response);
-        if (!isPermissionFormOpen || forceUpdatePermissions) {
-          const newPermissions = response.metadata?.permissions || [];
-          permissionsRef.current = newPermissions;
-          setPermissions(newPermissions);
+        if (runtimeContext) {
+          await queueRuntimeAITRefresh(runtimeContext);
         }
       } else {
-        // No token available, clear AIT data
-        aitRef.current = null;
-        permissionsRef.current = [];
-        setAit(null);
-        setPermissions([]);
+        clearRuntimeAuthorization();
       }
     } catch (error) {
-      console.error('Failed to fetch AIT:', error);
-      aitRef.current = null;
-      permissionsRef.current = [];
-      setAit(null);
-      setPermissions([]);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to recompute AIT:', error);
+      }
     } finally {
       // Keep the authorization snapshot current before refreshAIT resolves.
       // React may not commit setState until the immediate pending-tool retry.
@@ -1129,50 +1242,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  const waitForPersistedAITPermissions = async (
-    expectedPermissions: string[],
-  ): Promise<boolean> => {
-    const currentHitAddress = hitAddressRef.current || hitAddress;
-    const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
-    if (!currentHitAddress || !currentToken) return false;
-
-    authorizationLoadingStateRef.current.setAITLoading(true);
-    setIsAITLoading(true);
-    try {
-      const persistedAIT = await waitForAITPermissions({
-        expectedPermissions,
-        readAIT: async () => {
-          try {
-            const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-              serviceId,
-              controller: currentHitAddress,
-              customUsername: (!requireWalletIDVVerification && customUsername)
-                ? getFinalCustomUsername(customUsername)
-                : undefined,
-            }, currentToken);
-            return 'error' in response ? undefined : response;
-          } catch (error) {
-            console.warn('AIT permission propagation check failed:', error);
-            return undefined;
-          }
-        },
-        getPermissions: (currentAIT) => currentAIT.metadata?.permissions || [],
-      });
-
-      if (!persistedAIT) return false;
-
-      const persistedPermissions = persistedAIT.metadata?.permissions || [];
-      aitRef.current = persistedAIT;
-      permissionsRef.current = persistedPermissions;
-      setAit(persistedAIT);
-      setPermissions(persistedPermissions);
-      return true;
-    } finally {
-      authorizationLoadingStateRef.current.setAITLoading(false);
-      setIsAITLoading(false);
-    }
-  };
-
   // Check if user needs to sign in
   const isNeedSignInWithWallet = React.useMemo(() => {
     if (!hitAddress) return false;
@@ -1369,10 +1438,13 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       const { accessToken } = response;
       setNxtlinqAITServiceAccessToken(accessToken);
       nxtlinqAITServiceAccessTokenRef.current = accessToken;
-
-      // Wait for state to update before refreshing AIT
-      await new Promise(resolve => setTimeout(resolve, 100));
-      await refreshAIT();
+      localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+      await queueRuntimeAITRefresh({
+        controller: addressToUse,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      });
 
       if (autoShowSuccessMessage) {
         showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
@@ -1411,6 +1483,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         loading: authorizationLoadingStateRef.current.isLoading(),
       },
       ...authFields(),
+      ...(roles !== undefined ? { roles: [...roles] } : {}),
+      ...(permissionGroup !== undefined ? { permissionGroup } : {}),
       customUsername: (!requireWalletIDVVerification && customUsername)
         ? getFinalCustomUsername(customUsername)
         : undefined,
@@ -1858,6 +1932,14 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
 
           // Typed preflight already emitted the only permitted recovery UI.
           if (!isToolAllowed) {
+            // Do not leave suggestions from the previous turn visible while
+            // authorization recovery short-circuits the normal response path.
+            setSuggestions([]);
+            void updateSuggestions(
+              pseudoId,
+              localStorage.getItem('walletAddress') || undefined,
+              content,
+            );
             pendingTextToolRetryRef.current.set({
               content,
               isPresetMessage,
@@ -2482,108 +2564,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  // Generate and register AIT
-  const generateAndRegisterAIT = async (newPermissions?: string[], isFromAIAgent = false) => {
-    let currentSigner = signer;
-    let currentAddress = hitAddress;
-
-    // If we have an address but no signer, try to auto-connect wallet
-    if (currentAddress && !currentSigner) {
-      const storedWalletAddress = localStorage.getItem('walletAddress');
-      if (storedWalletAddress === currentAddress) {
-        try {
-          const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-          if (autoConnectResult) {
-            // Wait for state to update
-            await new Promise(resolve => setTimeout(resolve, 1000));
-            // Get the updated signer and address
-            currentSigner = signerRef.current || signer;
-            currentAddress = hitAddressRef.current || hitAddress;
-          }
-        } catch (error) {
-          console.error('Auto-connect failed during AIT generation:', error);
-        }
-      }
-    }
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-  };
-
-  // Generate and register AIT with explicit signer and address
-  const generateAndRegisterAITWithSigner = async (
-    newPermissions?: string[],
-    isFromAIAgent = false,
-    explicitSigner?: ethers.JsonRpcSigner,
-    explicitAddress?: string
-  ) => {
-    const currentSigner = explicitSigner || signer;
-    const currentAddress = explicitAddress || hitAddress;
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    // If AI Agent is creating, must check if user has existing AIT
-    if (isFromAIAgent && !aitRef.current) {
-      throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-    }
-
-    const timestamp = Math.floor(Date.now() / 1000);
-    const aitId = `did:polygon:nxtlinq:${currentAddress}:${timestamp}`;
-
-    const metadata = {
-      permissions: newPermissions || permissions,
-      issuedBy: currentAddress,
-    };
-
-    const metadataStr = stringify(metadata);
-    // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-    const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-
-    const uploadResponse = await nxtlinqApi.metadata.createMetadata(metadata, nxtlinqAITServiceAccessToken || '');
-    if ('error' in uploadResponse) {
-      throw new Error(`Failed to upload metadata: ${uploadResponse.error}`);
-    }
-
-    const { metadataCid } = uploadResponse;
-
-    const createAITParams = {
-      aitId,
-      controller: currentAddress,
-      serviceId,
-      metadataHash,
-      metadataCid,
-      isFromAIAgent: isFromAIAgent,
-      parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-    };
-
-    const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-
-    if ('error' in createAITResponse) {
-      throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-    }
-
-    const aitInfo = {
-      aitId,
-      controller: currentAddress,
-      metadata,
-      metadataHash,
-      metadataCid,
-    };
-
-    const nextPermissions = newPermissions || permissions;
-    aitRef.current = aitInfo;
-    permissionsRef.current = nextPermissions;
-    setAit(aitInfo);
-    setPermissions(nextPermissions);
-  };
-
-
-
   // Auto enable AIT permission
   const enableAIT = async (toolName: string) => {
     if (isAITEnabling) return false; // Prevent duplicate
@@ -2650,35 +2630,31 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
 
     try {
-      // Get available permissions to find the tool
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      if (!availablePermissionLabels.includes(toolName)) {
-        showError(`Tool ${toolName} is not available for your current identity provider`);
-        setIsAITEnabling(false);
-        return false;
-      }
-
-      // Get current permissions from AIT metadata instead of React state
-      // This ensures we don't lose existing permissions when enabling new ones
-      const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-      const newPermissions = [...currentAITPermissions];
-      if (!newPermissions.includes(toolName)) {
-        newPermissions.push(toolName);
-      }
-
-      // Filter out deleted permissions before saving
-      const validPermissions = newPermissions.filter(permission =>
-        availablePermissionLabels.includes(permission)
+      const context: RuntimeAITContext = {
+        controller: currentHitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const enabled = await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const current = await recomputeRuntimeAIT(context);
+          if (!current.maximumPermissions.includes(toolName)) {
+            return false;
+          }
+          const nextDeniedPermissions = removeOneDeniedPermission(
+            current.deniedPermissions,
+            toolName,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+          return true;
+        },
       );
-
-      // Generate and register AIT with new permissions
-      // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-      const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-
-      await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
-      const permissionsPersisted = await waitForPersistedAITPermissions(validPermissions);
-      if (!permissionsPersisted) {
-        showWarning('AIT permission was submitted but is still synchronizing. Please try again shortly.');
+      if (!enabled) {
+        showError(`Tool ${toolName} is not available for your current identity provider`);
         setIsAITEnabling(false);
         return false;
       }
@@ -2686,9 +2662,13 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       setIsAITEnabling(false);
       return true;
     } catch (error) {
-      console.error('Failed to auto-enable AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to auto-enable AIT:', error);
+      }
       setIsAITEnabling(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return false;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to enable AIT permission. Please try again.');
@@ -2701,23 +2681,43 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const savePermissions = async (newPermissions?: string[]) => {
     setIsDisabled(true);
     try {
-      // Filter out deleted permissions before saving
-      const permissionsToSave = newPermissions || permissions;
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      const validPermissions = permissionsToSave.filter(permission =>
-        availablePermissionLabels.includes(permission)
+      if (!hitAddress) {
+        throw new Error('Please connect your wallet first');
+      }
+      const context: RuntimeAITContext = {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const checkedPermissions = [...(newPermissions ?? permissions)];
+      await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const fresh = await recomputeRuntimeAIT(context);
+          const nextDeniedPermissions = replaceCurrentMaximumDenyList(
+            fresh.deniedPermissions,
+            fresh.maximumPermissions,
+            checkedPermissions,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+        },
       );
-
-      await generateAndRegisterAIT(validPermissions, false);
       showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
       setShowPermissionForm(false);
       setIsPermissionFormOpen(false);
       await refreshAIT(true);
       await retryPendingTextTool();
     } catch (error) {
-      console.error('Failed to generate AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to update AIT deny-list:', error);
+      }
       setIsDisabled(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to save permissions. Please try again.');
@@ -2766,15 +2766,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
                   const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                   if (!('error' in walletResponse)) {
                     setWalletInfo(walletResponse);
-                    const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                      serviceId,
+                    await queueRuntimeAITRefresh({
                       controller: address,
-                      customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                    }, token);
-                    if (!('error' in aitResponse)) {
-                      aitRef.current = aitResponse;
-                      setAit(aitResponse);
-                    }
+                      serviceId,
+                      ...(roles !== undefined ? { roles: [...roles] } : {}),
+                      ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                    });
                   }
                 } finally {
                   setIsWalletLoading(false);
@@ -2806,15 +2803,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
               const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
               if (!('error' in walletResponse)) {
                 setWalletInfo(walletResponse);
-                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                  serviceId,
+                await queueRuntimeAITRefresh({
                   controller: address,
-                  customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, token);
-                if (!('error' in aitResponse)) {
-                  aitRef.current = aitResponse;
-                  setAit(aitResponse);
-                }
+                  serviceId,
+                  ...(roles !== undefined ? { roles: [...roles] } : {}),
+                  ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                });
               }
             } finally {
               setIsWalletLoading(false);
@@ -2924,7 +2918,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     if (hitAddress && nxtlinqAITServiceAccessToken) {
       refreshAIT();
     }
-  }, [hitAddress, nxtlinqAITServiceAccessToken]);
+  }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
 
   // Set loading state when permission form opens
   React.useEffect(() => {
@@ -3013,6 +3007,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     updateExternalId()
   }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
 
+  const runtimeAuthorizationMatchesRenderedContext =
+    runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
   const contextValue: ChatBotContextType = {
     // State
     messages,
@@ -3020,9 +3016,16 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     isLoading,
     isOpen,
     hitAddress,
-    ait,
-    permissions,
-    availablePermissions,
+    ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+    permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+    maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+    deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+    runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+      ? runtimePermissionsUnavailable
+      : runtimeContext !== null,
+    availablePermissions: runtimeAuthorizationMatchesRenderedContext
+      ? availablePermissions
+      : [],
     showPermissionForm,
     isPermissionFormOpen,
     isAITLoading,
@@ -3059,7 +3062,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     setIsOpen,
     setShowPermissionForm,
     setIsPermissionFormOpen,
-    setPermissions,
     setIsDisabled,
     setIsWalletLoading,
     setNotification,
@@ -3110,6 +3112,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     onVerifyWallet: (method: 'berifyme' | 'custom') => handleVerifyWalletClick(method),
     serviceId,
     permissionGroup,
+    roles,
 
     // Props
     props: {
@@ -3128,6 +3131,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       getAuthToken,
       onVerifyWallet,
       permissionGroup,
+      roles,
       onModelChange,
       storageMode,
       requireWalletIDVVerification,